feat: create-activationにProductタグ付与オプションを追加 - #10
Merged
Conversation
PRODUCT 環境変数が設定されている場合のみ create-activation に
--tags Key=Product,Value=${PRODUCT} を付与する。アクティベーションのタグは
登録される ManagedInstance (mi-*) に自動継承されるため、Pod 再起動で
mi- ID が変わってもタグが剥がれない。未設定なら従来動作と完全互換。
あわせて create-activation の失敗チェックを追加。現状は失敗しても空変数の
まま register に進み、agent 未起動でも Pod が Running に見えるサイレント
故障になるため、exit 1 で CrashLoop として顕在化させる。
mi-* への Product タグ常時付与 → ssm:StartSession の
ssm:resourceTag/Product 条件によるプロダクト別接続制限
(globis-org/core-infra#4288) の Phase 1。
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
reiichii
requested review from
a team,
iryotakadowaki-hash and
matchan26
and removed request for
a team
July 31, 2026 03:36
iryotakadowaki-hash
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
https://github.com/globis-org/core-infra/issues/4288 の Phase 1。踏み台 mi-* に Product タグを常時付与し、将来的に JIT power の ssm:StartSession を ssm:resourceTag/Product 条件で自プロダクトに制限する。前提となる IAM 権限 (ssm:AddTagsToResource) は適用済み (https://github.com/globis-org/aws-products-infra/pull/9664 / https://github.com/globis-org/aws-ec2-infra/pull/1425)
変更内容
--tags Key=Product,Value=${PRODUCT}を付与 (未指定なら完全に従来動作)影響範囲
このスクリプトは各プロダクトの bastion イメージがビルド時に raw URL から ADD している。merge 後、各イメージの次回再ビルドから新スクリプトが入るが、PRODUCT env は各 k8s manifest で個別に追加するまで未設定のため挙動は変わらない。唯一 PRODUCT に関係なく効くのは失敗チェック (create-activation 失敗時に Running のまま沈黙 → CrashLoop に変わる)。
検証
gdp-dev の unlimited-bastion-dev1 で、タグ付き create-activation → 再登録により mi-* に Product タグが自動継承されることを確認済み (2026-07-29)
🤖 Generated with Claude Code